Natural patches: We used a total of \(N=\)  265,457 natural images from five sources: the ImageNet validation set [1]} (50,000) TinyImageNet [2]} (100,000), OpenSurfaces [3]} (57,500), the non OpenSurfaces images from Broden [4]} (37,953), plus several trojan triggers (4) (see Section ).
